# Security best practices

> Identity verification, allowed origins, CSP, and data-handling guidance.

Product: Clad Widget SDK
Source: https://docs.useclad.ai/widget/security

---

- **Verify identity with server‑minted JWTs.** Never embed the widget secret in
  frontend code. Keep tokens short‑lived.
- **Configure allowed origins** for your widget. Session creation is rejected
  from any other origin.
- **Don't send sensitive data** in `metadata`/`customFields` (passwords,
  secrets, full card numbers, tokens, PII you don't need).
- **Always `shutdown({ clearStorage: true })` on logout**, especially for shared
  devices.
- The widget renders end‑user text as plain text; agent replies and article
  bodies render as **sanitized HTML** (allowlist sanitizer — scripts, event
  handlers, and unsafe URLs are stripped). The UI runs in an isolated iframe
  as a security boundary.
- A reasonable **Content‑Security‑Policy** on your site can allow the widget
  explicitly, e.g. `script-src https://clad-server-production.up.railway.app; frame-src https://clad-server-production.up.railway.app; connect-src https://clad-server-production.up.railway.app wss://clad-server-production.up.railway.app`.